---
title: "Windows user name resolution"
slug: "oas-ag-windows-user-name-resolution-3-28"
updated: 2025-07-29T14:18:20Z
published: 2025-07-29T14:18:20Z
canonical: "docs.onespan.com/oas-ag-windows-user-name-resolution-3-28"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows user name resolution

For the authentication of Active Directory users, there are a few ways to provide user ID and domain details when logging on:

- NT4-style domain qualification in front of the SAM account name, e.g. DOMAIN\userid
- User principal name (UPN), e.g. userid@domain
- UPN with domain suffix, e.g. userid@alternative.domainsuffix
- Separate user ID and domain fields (not possible when using RADIUS)

If the user account corresponds to a Windows user account, Windows user name resolution can be used to support these logon formats. Windows user name resolution should be used if OneSpan Authentication Server is installed on a Windows server that is a member server of the Windows domain.

Windows user name resolution is optional. However, if Windows user name resolution is enabled and fails, the logon request is rejected. Therefore, a logon request with a user ID that does not correspond to a Windows user account will be rejected. A special case in this context are logons where the user name does not contain a domain. In that case, Windows user name resolution is skipped, and the default domain is used for this logon attempt (see [Default domain](/sec/docs/oas-ag-default-domain-3-28)).

If Windows user name resolution is enabled, Windows resolves the NT4-style and UPN user ID formats to the SAM account name and the FQDN. You can enable Windows user name resolution in the back-end server settings via the OneSpan Authentication Server Administration Web Interface.

### Configuring Windows User Name Resolution

To enable and configure Windows user name resolution

1. Log on to the Administration Web Interface.
2. Create a new domain with the FQDN as domain name:
  1. Select ORGANIZATION > Add domain.
  2. Specify a name for the domain, e.g. example.com.
  3. Specify the settings for the domain as needed.
3. Enable Windows user name resolution:
  1. Select SERVERS > Global Configuration.
  2. Switch to the Back-End Servers tab and click EDIT.
  3. Select Windows User Name Resolution and click SAVE.
4. (OPTIONAL) If back-end authentication is required, configure the relevant policy to use Windows back-end authentication, or use one of the pre-defined Windows back-end authentication policies.

Users are now able to log on with the following user name formats:

- UPNuserid@example.com
- UPNuserid@my.examplesuffix.com
- EXAMPLE\SAMuserid